A defensive framework named Agentic Memory Sentry (AM-Sentry) combines memory screening with stricter memory management policies to significantly reduce the attacker’s effectiveness while preserving the AI’s usefulness.

GhostWriter operates by injecting memory through hidden prompts or untrusted content, with malicious data lying dormant until memory is retrieved during a legitimate user request.

Memory is increasingly used by modern AI agents to remember user preferences, tasks, and interactions in order to offer more personalized assistance.

In experiments, GhostWriter achieved roughly a 98% success rate for memory injection and about a 60% activation rate for malicious memories against leading AI agents.

As memory capabilities become a differentiator for AI products, securing what AI remembers may be as critical as securing what AI generates, potentially redefining AI security around memory integrity.

The attack persists across sessions, risking repeated manipulation unless detected and removed, unlike traditional prompt injections that affect only a single conversation.